feat(repo): add Sponsor button + GH Packages mirror for sidebar surface#545
Conversation
Three additions that make the repo page surface clearer + give users
a single place to fund the project:
1. `.github/FUNDING.yml` — `github: [rohitg00]` renders the "Sponsor"
button at the top of the repo + the Sponsor widget in the right
sidebar. Requires GitHub Sponsors to be enabled at
github.com/sponsors/accounts on the rohitg00 profile before the
link resolves (currently 404s — enable before merging this PR).
2. `.github/workflows/publish.yml` — new `publish-github-packages`
job runs after the existing public-npm publish completes.
Republishes the main package as `@rohitg00/agentmemory` to
`npm.pkg.github.com`. The repo's right-sidebar "Packages" widget
only surfaces packages on GitHub Packages, not packages on the
public npm registry, so this is what makes the sidebar widget
non-empty. Public npm remains the canonical install source;
GH Packages is purely a discovery surface.
- Uses built-in GITHUB_TOKEN, no new secrets needed.
- Rewrites package.json `name` + `publishConfig` in-runner via a
small node one-liner, publishes, then restores the original so
main isn't permanently scope-changed.
- Skip-on-already-published guard mirrors the existing public
publish steps.
- Marked `|| echo "non-fatal"` so a GH Packages hiccup never blocks
the canonical npm release.
- `permissions: packages: write` added at workflow level.
3. README badge row — added `npm downloads`, `GitHub Packages mirror`,
and `Sponsor rohitg00 on GitHub Sponsors` badges alongside the
existing `npm version` / `CI` / `License` / `Stars` row. The
sponsor badge is the same link the FUNDING.yml sidebar widget
uses; surfacing it in-README means readers who don't notice the
sidebar still see it.
Out of scope (asked, declined):
- Docker Hub / ghcr.io publish workflow. Not in this PR.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
📝 WalkthroughWalkthroughThis PR adds GitHub Sponsors configuration, updates README badges, and extends the publish workflow to mirror releases to GitHub Packages (with scoped permissions and conditional publish logic). ChangesGitHub distribution channels
Sequence DiagramsequenceDiagram
participant CI as GitHub Actions
participant npm as npm Registry
participant gh as GitHub Packages
CI->>npm: Publish agentmemory to npm
CI->>gh: Check if `@rohitg00/agentmemory` version exists
alt Version not found
CI->>CI: Backup & rewrite package.json to `@rohitg00` scope + registry
CI->>gh: Publish package to npm.pkg.github.com using GITHUB_TOKEN
CI->>CI: Restore original package.json
else Version exists
CI->>CI: Skip GitHub Packages publish
end
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/publish.yml:
- Around line 17-20: The workflow currently grants elevated permissions
(packages: write and id-token: write) at the top-level permissions block; remove
or reduce those workflow-wide entries and instead add scoped permissions on the
specific jobs that require them (e.g., in the job definitions that perform
publishing or need OIDC tokens), granting only packages: write and id-token:
write on those job-level permissions blocks; also apply the same change for the
other top-level permissions occurrences referenced (the second block around the
127-129 region) so no job inherits unnecessary write scopes.
- Around line 130-136: Pin the workflow actions to fixed commit SHAs and harden
credentials/caching: replace the floating tags actions/checkout@v6 and
actions/setup-node@v6 with the corresponding pinned commit SHAs, add
persist-credentials: false to the actions/checkout step, and explicitly disable
package-manager caching in the actions/setup-node step (e.g., set cache: 'none'
or the setup-node option that turns off caching) so the publish job does not
persist credentials or enable package manager caches.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: f9c05779-6790-483d-b769-e9870ca1134e
📒 Files selected for processing (3)
.github/FUNDING.yml.github/workflows/publish.ymlREADME.md
| - uses: actions/checkout@v6 | ||
|
|
||
| - uses: actions/setup-node@v6 | ||
| with: | ||
| node-version: 22 | ||
| registry-url: https://npm.pkg.github.com | ||
| scope: "@rohitg00" |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Verify this workflow still has floating action tags and missing hardening flags.
rg -n '^\s*-\s*uses:\s*[^@]+@v[0-9]+' .github/workflows/publish.yml
rg -n 'persist-credentials:\s*false|package-manager-cache:\s*false' .github/workflows/publish.ymlRepository: rohitg00/agentmemory
Length of output: 218
Pin action SHAs and disable credential persistence in publish workflow.
The publish workflow uses floating action tags (actions/checkout@v6 and actions/setup-node@v6 at lines 130-132) instead of pinned commit SHAs, increasing supply-chain risk. Additionally, the checkout action does not disable credential persistence, and the setup-node action does not explicitly disable package-manager cache—both critical hardening measures for privileged jobs.
Suggested hardening diff
- - uses: actions/checkout@v6
+ - uses: actions/checkout@<pinned-commit-sha>
+ with:
+ persist-credentials: false
- - uses: actions/setup-node@v6
+ - uses: actions/setup-node@<pinned-commit-sha>
with:
node-version: 22
registry-url: https://npm.pkg.github.com
scope: "`@rohitg00`"
+ package-manager-cache: false🧰 Tools
🪛 zizmor (1.25.2)
[warning] 130-130: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false
(artipacked)
[error] 130-130: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[error] 132-132: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[error] 132-132: runtime artifacts potentially vulnerable to a cache poisoning attack (cache-poisoning): enables caching by default
(cache-poisoning)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/publish.yml around lines 130 - 136, Pin the workflow
actions to fixed commit SHAs and harden credentials/caching: replace the
floating tags actions/checkout@v6 and actions/setup-node@v6 with the
corresponding pinned commit SHAs, add persist-credentials: false to the
actions/checkout step, and explicitly disable package-manager caching in the
actions/setup-node step (e.g., set cache: 'none' or the setup-node option that
turns off caching) so the publish job does not persist credentials or enable
package manager caches.
Inline review on #545 flagged that the workflow-level permissions block granted `id-token: write` + `packages: write` to every job, including ones that don't need them. Tightened to least-privilege: - Workflow-level: only `contents: read`. - `publish` job: adds `id-token: write` (required for `npm publish --provenance` to mint a Sigstore OIDC token). The GH Packages job doesn't inherit this. - `publish-github-packages` job: adds `packages: write` (required to push to npm.pkg.github.com). The public-npm publish job doesn't inherit this. Both `actions/checkout@v6` calls also pick up `persist-credentials: false`. The publish steps never push back to the repo, so the GITHUB_TOKEN doesn't need to land in `.git/config` after checkout. Same posture both jobs. Skipped from the same review pass: - **Pin actions to commit SHAs.** Industry rule but introduces real maintenance friction — Renovate/Dependabot don't auto-bump SHA-pinned actions to new minors, so SHA pinning trades easy semver tracking for stale-action drift. We stay on `@v6` major-tag pins (GitHub publishes those via verified moving refs). - **Disable setup-node cache.** `actions/setup-node@v6` defaults to cache-off (the `cache:` input is opt-in). `package-manager-cache` only auto-enables when `package.json` has a `packageManager` field — agentmemory's doesn't (verified via `grep`). The fix is a no-op on this workflow.
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/publish.yml:
- Around line 157-173: The workflow currently rebuilds the package (npm install
/ npm ci / npm run build) then repackages for GitHub Packages in the "Publish
`@rohitg00/agentmemory` to GitHub Packages" step, which can produce a different
tarball than the original npm pack artifact; instead, download the packed
artifact produced by the first job (the uploaded npm pack tarball),
verify/extract or use that exact tarball for publishing (npm publish <tarball>
--registry=https://npm.pkg.github.com) rather than rebuilding, and keep the
existing logic around VERSION and the package.json scope rewrite/check (or adapt
it to operate on the unpacked/packed artifact) so the exact same artifact from
the earlier job is mirrored to GitHub Packages.
- Around line 137-173: The mirror job should be genuinely best-effort: mark the
whole job as non-fatal by adding continue-on-error: true to the job definition
(so failures in the npm install, npm ci, npm run build or the package.json
rewrite won't fail the release), or alternatively set continue-on-error: true on
the individual setup/install/build steps (npm install, npm ci, npm run build)
before the "Publish `@rohitg00/agentmemory` to GitHub Packages" step; ensure the
canonical publish job remains authoritative by leaving its behavior unchanged
and only making this mirror job tolerant of failures.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: acacfdc8-ba40-4452-a2cf-c1e6ff386d37
📒 Files selected for processing (1)
.github/workflows/publish.yml
| needs: publish | ||
| runs-on: ubuntu-latest | ||
| # `packages: write` only here — the public-npm publish job | ||
| # doesn't need it. `contents: read` for the checkout. | ||
| permissions: | ||
| contents: read | ||
| packages: write | ||
| steps: | ||
| - uses: actions/checkout@v6 | ||
| with: | ||
| # Same posture as the publish job — no push back to the | ||
| # repo, so don't persist the token to `.git/config`. | ||
| persist-credentials: false | ||
|
|
||
| - uses: actions/setup-node@v6 | ||
| with: | ||
| node-version: 22 | ||
| registry-url: https://npm.pkg.github.com | ||
| scope: "@rohitg00" | ||
|
|
||
| - run: npm install --package-lock-only --legacy-peer-deps --no-audit --no-fund | ||
| - run: npm ci --legacy-peer-deps --no-audit --no-fund | ||
| - run: npm run build | ||
|
|
||
| - name: Publish @rohitg00/agentmemory to GitHub Packages | ||
| run: | | ||
| VERSION=$(node -p "require('./package.json').version") | ||
| # Save original package.json, rewrite scope for GH Packages, | ||
| # publish, restore. Avoids a permanent scope change in main. | ||
| cp package.json package.json.bak | ||
| node -e "const p=require('./package.json');p.name='@rohitg00/agentmemory';p.publishConfig={registry:'https://npm.pkg.github.com'};require('fs').writeFileSync('package.json',JSON.stringify(p,null,2));" | ||
| if npm view "@rohitg00/agentmemory@$VERSION" version --registry=https://npm.pkg.github.com >/dev/null 2>&1; then | ||
| echo "GH Packages version already published, skipping" | ||
| else | ||
| npm publish --access public || echo "GH Packages publish failed (non-fatal)" | ||
| fi | ||
| mv package.json.bak package.json |
There was a problem hiding this comment.
Make the mirror job genuinely best-effort.
Only Line 171 is treated as non-fatal. Checkout/install/build/rewrite failures in this job still fail the release workflow even after the canonical npm publish has succeeded.
Suggested hardening diff
publish-github-packages:
needs: publish
runs-on: ubuntu-latest
+ continue-on-error: true
# `packages: write` only here — the public-npm publish job
# doesn't need it. `contents: read` for the checkout.
permissions:🧰 Tools
🪛 zizmor (1.25.2)
[info] 171-171: prefer trusted publishing for authentication (use-trusted-publishing): this command
(use-trusted-publishing)
[error] 145-145: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[error] 151-151: unpinned action reference (unpinned-uses): action is not pinned to a hash (required by blanket policy)
(unpinned-uses)
[error] 151-151: runtime artifacts potentially vulnerable to a cache poisoning attack (cache-poisoning): enables caching by default
(cache-poisoning)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/publish.yml around lines 137 - 173, The mirror job should
be genuinely best-effort: mark the whole job as non-fatal by adding
continue-on-error: true to the job definition (so failures in the npm install,
npm ci, npm run build or the package.json rewrite won't fail the release), or
alternatively set continue-on-error: true on the individual setup/install/build
steps (npm install, npm ci, npm run build) before the "Publish
`@rohitg00/agentmemory` to GitHub Packages" step; ensure the canonical publish job
remains authoritative by leaving its behavior unchanged and only making this
mirror job tolerant of failures.
| - run: npm install --package-lock-only --legacy-peer-deps --no-audit --no-fund | ||
| - run: npm ci --legacy-peer-deps --no-audit --no-fund | ||
| - run: npm run build | ||
|
|
||
| - name: Publish @rohitg00/agentmemory to GitHub Packages | ||
| run: | | ||
| VERSION=$(node -p "require('./package.json').version") | ||
| # Save original package.json, rewrite scope for GH Packages, | ||
| # publish, restore. Avoids a permanent scope change in main. | ||
| cp package.json package.json.bak | ||
| node -e "const p=require('./package.json');p.name='@rohitg00/agentmemory';p.publishConfig={registry:'https://npm.pkg.github.com'};require('fs').writeFileSync('package.json',JSON.stringify(p,null,2));" | ||
| if npm view "@rohitg00/agentmemory@$VERSION" version --registry=https://npm.pkg.github.com >/dev/null 2>&1; then | ||
| echo "GH Packages version already published, skipping" | ||
| else | ||
| npm publish --access public || echo "GH Packages publish failed (non-fatal)" | ||
| fi | ||
| mv package.json.bak package.json |
There was a problem hiding this comment.
Publish the same tarball that npm got.
Lines 157-160 rebuild from a fresh dependency resolution instead of reusing the artifact produced by publish. Because this repo generates its lockfile in-runner, the GitHub Packages copy can diverge from the npm package for the same version.
Mirror the packed artifact from the first job (npm pack + upload/download artifact) rather than rebuilding here.
🧰 Tools
🪛 zizmor (1.25.2)
[info] 171-171: prefer trusted publishing for authentication (use-trusted-publishing): this command
(use-trusted-publishing)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/publish.yml around lines 157 - 173, The workflow currently
rebuilds the package (npm install / npm ci / npm run build) then repackages for
GitHub Packages in the "Publish `@rohitg00/agentmemory` to GitHub Packages" step,
which can produce a different tarball than the original npm pack artifact;
instead, download the packed artifact produced by the first job (the uploaded
npm pack tarball), verify/extract or use that exact tarball for publishing (npm
publish <tarball> --registry=https://npm.pkg.github.com) rather than rebuilding,
and keep the existing logic around VERSION and the package.json scope
rewrite/check (or adapt it to operate on the unpacked/packed artifact) so the
exact same artifact from the earlier job is mirrored to GitHub Packages.
|
Already addressed in a29a696 (pushed earlier this session, may have been against the previous round of inline review against Finding 1 (workflow-wide write perms): FIXED. Workflow-level
Neither job inherits a scope it doesn't need. Finding 2a (persist-credentials: false): FIXED. Both Finding 2b (pin actions to commit SHAs): SKIPPED. Rationale: pinning to SHAs adds real maintenance cost — Renovate/Dependabot don't auto-bump SHA-pinned actions to new minors, so SHA pinning trades easy semver tracking for stale-action drift. agentmemory pins to verified major-version moving refs ( Finding 2c (disable setup-node cache): SKIPPED — no-op. Verified All findings either shipped or skipped with explicit rationale. Latest commit on the branch is |
Sponsor button still missing from the repo page despite #545 merging. The committed FUNDING.yml started with 4 lines of `#` comments before the canonical `github: [rohitg00]` directive. GitHub's FUNDING parser documents only the canonical key-value form; leading comments shouldn't break it but some users have reported indexer lag when the file starts with non-data lines. Strip to the bare single-line form to match the documented schema and remove any ambiguity. Sponsor profile is enabled (github.com/sponsors/rohitg00 returns 200 + 'Sponsor @rohitg00' button), so the only remaining gap is GitHub's side-bar indexing. Tightening the file forces a re-parse.
…548) Reverting the GH Packages publish from #545. GH Packages is a separate registry from npmjs.com — anyone installing `@rohitg00/agentmemory` from `npm.pkg.github.com` needs to point their registry there and authenticate, which is friction users don't have on the canonical `@agentmemory/agentmemory` install from public npm. The right-sidebar Packages widget on the repo page was the only motivation for the mirror. Acceptable to leave it empty — the single canonical install path is the better DX. - Drop `publish-github-packages` job from `.github/workflows/publish.yml` - Drop `packages: write` perm wording from the workflow comment block - Remove "GitHub Packages mirror" badge from README Manual follow-up (post-merge): delete the already-published `@rohitg00/agentmemory@0.9.20` from GH Packages registry via github.com/users/rohitg00/packages/npm/agentmemory/settings → Delete.
1 participant
Summary
Three additions that make the repo's right-sidebar surface non-empty + give users a one-click fund path.
1.
.github/FUNDING.ymlRenders the Sponsor button at the top of the repo + the Sponsor widget in the right sidebar.
2.
publish-github-packagesjob in.github/workflows/publish.ymlThe repo's right-sidebar Packages widget only surfaces packages published to GitHub Packages, not packages on the public npm registry. New job runs after the existing canonical npm publish completes:
package.json.namefrom@agentmemory/agentmemory→@rohitg00/agentmemoryin-runnerpublishConfig.registry: https://npm.pkg.github.compackage.jsonso main isn't permanently scope-changed|| echo "non-fatal") so a GH Packages hiccup never blocks the canonical npm releaseAuth uses the built-in
GITHUB_TOKEN, no new secrets needed. Workflow-levelpermissions: packages: writeadded.Same pattern SkillKit ships today (
@rohitg00/skillkiton GH Packages mirroringskillkiton npm).3. README badge row
Added three badges alongside the existing npm/CI/License/Stars row:
npm downloads(live monthly count)GitHub Packages mirror(links to the new GH Packages page)Sponsor rohitg00(links to https://github.com/sponsors/rohitg00, same as the sidebar widget)Verification
node -e "...split('\n').length"clean; job names present)..github/FUNDING.ymlis single-key valid YAML.<p>block — no layout shift.Manual follow-up (post-merge)
rohitg00so the FUNDING.yml link resolves.gh release list→ newest release → check the repo right-sidebar after ~2 minutes.Summary by CodeRabbit
Chores
Documentation